Overview

BoostSecurity MCP is a Model Context Protocol (MCP) server that enforces dependency guardrails for agentic AI development workflows. It inspects every package an AI agent attempts to add—across PyPI, npm, Maven, Go Modules, and NuGet—flagging packages that are vulnerable, malicious, end-of-life, nonexistent (hallucinations), or likely typosquats. When risks are detected, BoostSecurity MCP can block the addition and recommend safer, actively maintained alternatives.

The server integrates with MCP-capable clients (editor plugins, AI platforms, and CI tools) so agents can validate dependencies before modifying project manifests. This reduces supply chain risks introduced by autonomous code suggestions while letting teams continue to adopt productivity-boosting agent workflows confidently.

GitHub: https://github.com/boost-community/boost-mcp

Features

Validates package existence and authenticity (detects hallucinations and typosquatting)
Detects known vulnerabilities (including high/critical severity)
Flags end-of-life or unmaintained packages
Identifies packages associated with malware or malicious activity
Recommends secure, maintained alternative packages and versions
Simple HTTP-based MCP server for easy integration with MCP clients
Supports common ecosystems: PyPI, npm, Maven, Go Modules, NuGet

Supported ecosystems

Language / Platform	Package Registry
Python	PyPI
JavaScript / TypeScript	npm
Java	Maven
Go	Go Modules
C#	NuGet

Installation / Configuration

Prerequisites: an MCP-compatible client (Cursor, Claude Code, Windsurf, VS Code, CI integrations).

Common MCP server URL: https://mcp.boostsecurity.io/mcp Transport: http

Example client configurations:

Cursor (settings JSON snippet)

{
  "mcpServers": {
    "boost-security": {
      "url": "https://mcp.boostsecurity.io/mcp",
      "transport": "http"
    }
  }
}

Claude Code (CLI)

claude mcp add --scope user --transport http boost-security https://mcp.boostsecurity.io/mcp

Windsurf (settings JSON snippet)

{
  "mcpServers": {
    "boost-security": {
      "serverUrl": "https://mcp.boostsecurity.io/mcp"
    }
  }
}

VS Code (MCP user configuration)

{
  "servers": {
    "boost-security": {
      "type": "http",
      "url": "https://mcp.boostsecurity.io/mcp"
    }
  }
}

Notes:

After adding the remote server to your client, enable or start the MCP connection in the client UI.
Any MCP-compliant client that supports HTTP transport and remote servers can use BoostSecurity MCP.

Available Tools

validate_package
- Purpose: Evaluate whether a package (name + optional version) is safe to add to a project.
- Returns: safe/unsafe classification, risk details (vulnerabilities, EOL, malicious indicators, typosquat suspicion), and recommended alternatives (package names and suggested versions).
- Usage pattern: call validate_package before modifying manifest files or running package managers.

Example agent instruction to ensure consistent use:

Always use the BoostSecurity MCP tool `validate_package` to ensure a package is safe before adding it to a project. Use the package versions recommended by BoostSecurity.

Use Cases

Prevent agent hallucinations: An AI suggests a nonexistent package name — validate_package detects the missing package and blocks the change.
Block typosquatting attacks: Agents sometimes propose packages that impersonate popular libs (e.g., single-character misspellings). The MCP flags likely typosquats and offers the correct package.
Avoid vulnerable dependencies: During a suggested dependency upgrade, validate_package surfaces CVEs and recommends secure versions or alternative libraries.
CI / pre-merge checks: Integrate the MCP server in CI pipelines or pre-commit hooks so any dependency changes proposed by bots or humans are validated before merge.
Safe local AI-assisted development: Configure your editor/assistant (Cursor, Claude Code, VS Code, etc.) to validate packages in real time so suggestions remain safe during interactive coding sessions.

Best practices

Add a rule to your agent prompts instructing it to call validate_package before any package addition.
Enforce validate_package calls in CI for dependency changes to ensure automated PRs are checked.
Prefer suggested alternatives and recommended versions from BoostSecurity to minimize risk.
Regularly review MCP diagnostic output and adjust project policy thresholds (e.g., block medium severity vs. only high/critical).

Resources

Repository: https://github.com/boost-community/boost-mcp
MCP protocol docs (client-specific): consult your MCP client documentation to learn how to add remote MCP servers and call tools from agents.

BoostSecurity MCP Server: Guardrails Against Vulnerabilities, Typosquatting